EIP-2026-110297

This exploit demonstrates an authenticated path traversal vulnerability in OpenEMR versions prior to 5.0.2, allowing an attacker to read arbitrary files on the server by manipulating the 'fileName' parameter in the 'ajax_download.php' endpoint.